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ABSTRACT 

To  counteract  the  enemy  organization,  knowledge  of  the  principles  under  which  this  organization  operates 
is  required.  This  knowledge  provides  the  ability  to  detect  and  predict  the  activities  of  the  enemy  and  to 
select  the  appropriate  counter-actions.  Certain  counter-actions  require  additional  knowledge  about  enemy 
organization  and  processes  -  ranging  from  the  specifics  of  organizational  command,  control, 
communication  and  information  distribution  (C3I)  structures  to  the  responsibility  delegation  and  goals  at 
the  most  important  enemy  nodes.  Our  paper  proposes  to  solve  the  problem  of  identifying  the  enemy 
organization  and  activities  via  the  NetSTAR  system  employing  a  hybrid  multi-phase  model-based 
structure  and  process  identification  approach.  The  basis  for  NetSTAR  is  an  innovative  methodology  that 
integrates  a  social  network  model  of  coordination,  a  meta-task  model  of  enemy  goals,  and  a  Hidden- 
Markov  Model  (HMM)  of  enemy  activities  to  detect  subgroups  engaged  in  coordinated  activities.  This 
model  enables  the  computation  of  the  likelihood  of  the  hypothesized  organizational  structure  and 
processes  given  the  observed  behavior,  and  allows  designing  effective  dynamic  counter-action  strategies 
via  Partially  Observable  Markov  Decision  Processes  (POMDP)  modeling. 
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1.  Introduction 

Analysis  of  the  behavior  of  organizations,  ranging  from  the  more  structured  command  systems  of 
a  conventional  military  to  the  decentralized  and  elusive  insurgent  and  terrorist  groups,  suggest 
that  the  strong  relationship  exists  between  the  structure,  resources,  and  objectives  of  those 
organizations  and  the  resulting  actions.  The  organizations  act  in  their  missions  by  accomplishing 
tasks  which  may  leave  detectable  events  in  the  information  space.  The  dynamic  evolution  of 
these  events  creates  patterns  of  the  potential  realization  of  organizational  activities  and  may  be 
related,  linked,  and  tracked  over  time  (Pattipati  et  al.,  2004).  The  observational  data,  however,  is 
very  sparse,  creating  a  challenge  to  connect  relatively  few  enabling  events  embedded  within 
massive  amounts  of  data  flowing  into  the  government’s  intelligence  and  counter-terrorism 
agencies  (Popp  et  al.,  2004). 

To  counteract  the  enemy  organization,  knowledge  of  the  principles  and  goals  under  which  this 
organization  operates  is  required.  This  knowledge  provides  the  ability  to  detect  and  predict  the 
activities  of  the  enemy  and  to  select  the  appropriate  counter-actions.  However,  certain  counter¬ 
actions  require  additional  knowledge  of  the  specifics  of  organizational  structure  and 
responsibility  distribution  to  be  successfully  directed  at  the  most  important  enemy  nodes.  Our 
paper  proposes  to  solve  the  problem  of  identifying  the  enemy  command  organization  and 
activities  via  the  NetSTAR  system,  a  hybrid  model-based  structure  and  process  identification 
methodology. 

This  paper  is  organized  as  follows.  Section  2  outlines  the  context  of  the  problem  we  are 
addressing.  Section  3  provides  a  detailed  description  of  the  proposed  hybrid  NetSTAR  system, 
including  definition  and  workflow  of  the  phases  of  the  methodology  and  resulting  system 
components. 

2.  Problem  Context 

Given  the  set  of  events  and  transactions  observations,  friendly  (BLUE)  forces  need  to  identify 
the  command  structure  and  action  process  flow  of  the  enemy  (RED)  organization.  The 
command  structure  of  the  organization  is  represented  as  the  set  of  organizational  nodes  (which 
may  include  individuals,  cells,  sub-structures,  resources,  etc.)  and  their  role  distribution.  The 
role  of  a  node  is  defined  through  its  rules  of  engagement,  and  materializes  in  node  tasking  and 
inter-node  information  flow.  The  same  RED  organization  can  be  engaged  in  different 
operational  modes  (also  termed  “missions”)  at  different  times.  We  assume  that  two  types  of 
observations  can  be  received: 

(a)  Communication  Transactions,  also  termed  “chatter”,  -  are  instances  of  communication 
between  nodes  of  the  RED  team,  with  time,  duration,  and  possibly  (partial)  content  of 
communication  specified  (e.g.,  “members  of  militant  wing  engaged  in  a  meeting  with 
weapons  suppliers  at  1 1 :35  am  for  35  min  to  procure  explosives”);  and 

(b)  Events  -  network  interventions  that  identify  the  ongoing  activities  of  RED  agents/cells,  with 
specified  time,  agents  and  resources  (e.g.,  “BLUE  team  discovered  a  safehouse  and 
apprehended  arms  dealers  and  RED  operatives  attempting  to  procure  weapons”). 
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3.  Proposed  Solution:  NetSTAR 

NetSTAR  is  a  hybrid  model-based  structure  and  process  identification  methodology  employing  a 
Social  Network  Model  to  identify  collaborating  subgroups  of  RED  nodes  within  the  larger 
organization,  a  hierarchical  meta-task  graph  model  to  represent  enemy  goals,  a  Hidden  Markov 
Model  to  define  the  evolution  of  organizational  processes  and  activities  (including 
communication,  individual  and  team  tasking,  information  dissemination,  resource  employment, 
etc.),  and  a  Partially  Observable  Hidden  Markov  Model  to  develop  effective  counter-action 
policies.  NetSTAR  is  designed  to  have  the  following  capabilities: 

(i)  Identify  the  organizational  structure  and  predict  the  operational  processes  of  the  enemy. 
NetSTAR  employs  an  innovative  methodology  that  integrates  a  social  network  model  of 
coordination,  a  meta-task  model  of  enemy  goals,  and  a  Hidden-Markov  Model  of  enemy 
activities  to  detect  subgroups  engaged  in  coordinated  activities.  This  model  enables  the 
computation  of  the  likelihood  of  the  hypothesized  organizational  structure  and  processes 
given  the  observed  behavior; 

(ii)  Track  and  identify  enemy  nodes  and  members :  NetSTAR  employs  probabilistic  role 
association  to  determine  the  roles  and  responsibilities  of  observed  enemy  team  members, 
nodes,  cells,  etc.; 

(iii)  Identify  and  assess  potential  threats :  NetSTAR  represents  the  current  activities  of  the 
enemy  in  the  form  of  a  transition  graph  generated  from  mission  templates;  the  matched 
(i.e.,  the  most  likely)  model  is  employed  to  forecast  the  dynamic  evolution  of  future 
enemy  actions; 

(iv)  Generate  effective  counter-actions :  NetSTAR  employs  Partially  Observable  Markov 
Decision  Process  formalisms  to  identify  the  best  counter-action  policy  in  a  stochastic 
mission  environment. 

3.1  NetSTAR  Phases  and  Workflow 

To  achieve  above  capabilities,  NetSTAR  is  composed  of  the  following  5  interacting  modeling 
phases  (see  Figure  1).  Phase  1  employs  a  Social  Network  Model  to  identify  collaborating 
subgroups  of  RED  nodes  within  a  larger  organization.  Phase  2  simulates  the  behavior  of  enemy 
organization  executing  given  mission.  Phase  3  defines  the  evolution  of  organizational  processes 
and  activities  (including  communication,  individual  and  team  tasking,  information  dissemination, 
resource  employment,  etc.)  using  Markov  Transition  Diagram  and  Hidden  Markov  Model 
representations.  Phase  4  identifies  currently  active  organizations  and  missions  from 
observations  via  tracking  events,  activities  and  processes  using  a  Hidden  Markov  Model. 
Finally,  phase  5  develops  effective  counter-action  policies  by  formulating  the  problem  as  a 
Partially  Observable  Markov  Decision  Problem  (POMDP). 

A.  Knowledge  Base 

To  address  the  enemy  organization  identification  problem,  we  first  design  the  knowledge  base 
(KB)  of  RED  organizational  structures,  models  of  operation,  and  processes.  The  KB  consists  of 
two  main  components:  (i)  organization  library;  and  (ii)  mission  library.  The  organization  library 
contains  various  structures  of  enemy  organizations,  which  are  constructed  from  well  understood 
enemy  formations  that  have  been  met  in  the  past,  as  well  as  hypothesized  novel  organizational 
forms.  The  enemy  organization  is  represented  in  the  organization  library  as  the  set  of  nodes  with 
specified  roles,  responsibilities,  and  relationships  between  them  (e.g.,  command  topology, 
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communication  network,  information  access  structure,  resource  ownership,  etc.).  The  nodes  in 
the  organization  might  represent  terrorist  cells,  individual  team  members,  resources,  etc.  The 
roles  and  responsibilities  of  the  nodes  identify  the  action  selection,  operational  policy,  and 
information  flow  in  the  enemy  network.  The  organizational  library  defines  the  basis  from  which 
the  most  likely  organization  is  identified  using  sparse,  uncertain  observations. 


Knowledge  Base/Hypotheses 

Mission  Meta-Task  Library  Organization  Library 


Input  Data 


Event  Data 


Tracked 

Agents/Cells 


Activity  (e.g., 
Communication, 

,  Transactions)  Data 


i=) 


NetSTAR  System 


2.  Simulation 


Organizational 

Simulator 


Historic  Engagements 

, _ \ 

:::  C*» 

r 

^■C=i  s  Epi  1  : 

1/ 

3.  Learning 


HMM-based  Activity 
Pattern  Learning 


1.  Network  Clustering 


Classification  and 
subgroup 
identification 


4.  Monitoring 


HMM-based  Activity 
Matching  with 
Probabilistic  Roles 
Association 


5.  Action  Selection 


BLUE  Action  Policy 
Selection  via  POMDP 


NetSTAR  Output 


Meta-Task  Graph  of 
Goals/Objectives 


Command 
Structure,  Roles, 
Responsibilities 


Objectives 
Completion  and 
Activity  Involvement 


Suggested  Actions: 

•ISR/Probing 

•Interventions 


Figure  1:  NetSTAR  hierarchical  structure  and  data  flow 

While  the  organizational  forms  are  static  constructs,  their  dynamic  operations  are  defined  through 
the  environment,  mission,  and  organizational  goals.  These  variables  are  specified  in  the  mission 
library,  which  contains  meta-task  graphs  corresponding  to  specific  missions  and  objectives  that 
enemy  organization  might  perform.  Each  task  in  a  meta-task  graph  represents  the  intermediate 
goal  or  a  collection  of  goals  of  the  enemy  organization.  The  precedence  constraints  among  meta¬ 
task  graph  nodes  limit  the  feasible  sequencing  of  goals  achieved  by  mission  execution  policies. 

B.  Meta-Task  Representation:  Process-Action  Graph 

Each  individual  meta-task  execution  involves  the  pattern  of  processes/activities  that  the  enemy 
might  employ  to  achieve  the  corresponding  goal.  Various  methodologies  may  be  utilized  to 
model  these  constructs,  including  Applied  Cognitive  Task  Analysis,  Bayesian  Networks, 
Transition  Graphs,  Markov  Decision  Processes,  etc.  Therefore,  each  meta-task  will  be 
decomposed  into  a  substructure  that  defines  the  processes,  communication,  and  actions  of  RED 
team  members  that  trigger  the  observations  obtained  by  BLUE  organization.  This  process- 
action  graph  substructure  and  its  contents  (specific  RED  process  decomposition  parameters  and 
BLUE  counter-actions)  are  obtained  separately  for  each  organization-mission  pair  from  the 
Knowledge  Base  based  on  well-understood  or  hypothesized  enemy  doctrine  gleaned  from 
analysis  of  past  events,  exercises,  maneuvers  and  war-games. 

In  NetSTAR,  we  propose  to  model  the  process-action  graph  substructure  of  the  meta-task  graph 
as  a  Markov  Decision  Process  (MDP)  (Meirina  et  al.  2002).  MDP  addresses  the  issues  of 
uncertainty  of  action  outcomes  and  consists  of  state  nodes,  action  (control)  nodes,  utility/reward 
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function  associated  with  applying  actions  and  reaching  state  nodes,  and  links  associated  with 
transition  probabilities.  In  our  modeling  paradigm,  state  nodes  indicate  the  processes  (action, 
communication,  or  operation,  and  associated  participating  nodes  of  RED  team)  that  the  enemy 
organization  must  execute  in  order  to  achieve  the  goal  associated  with  the  corresponding  meta¬ 
task,  and  the  actions  specifying  what  the  BLUE  organization  can  do  to  influence  the  activities  of 
the  enemy.  When  the  BLUE  organization  does  not  perform  any  actions,  the  MDP  converts  into 
probabilistic  Markov  state  transition  model.  As  a  result,  each  organization-mission  pair  from  the 
Knowledge  Base  results  in  an  expanded  probabilistic  process  transition  graph. 

In  the  enemy  identification  problem,  the  observations  obtained  by  BLUE  are  very  often  unclear. 
The  uncertainty  occurs  when  the  observation  cannot  be  classified  to  belong  to  only  a  single 
process  from  all  feasible  meta-task  substructures.  In  this  situation,  a  Partially  Observable 
Markov  Decision  Problem  (POMDP)  can  be  successfully  applied.  However,  the  difficulty  arises 
when  the  correct  MDP  defining  the  workflow  processes  of  the  RED  team  is  not  known.  In  this 
case,  the  action  policies  determined  for  one  fixed  MDP  or  POMDP  might  not  reflect  the  real 
operations  of  RED  team,  and  therefore  will  not  achieve  the  desirable  result. 

3.2  Identification  of  Mission  Teams:  Network  Clustering  and  Social  Network  Analysis 

Equipped  with  a  knowledge  base  describing  hypothesized  organizational  structures  and  mission 
activities,  the  first  step  in  the  NetSTAR  algorithm  is  to  identify  the  subgroups  within  the  total  set 
of  RED  nodes  under  surveillance  that  are  actively  collaborating  toward  a  mission.  Our  approach 
is  based  on  constructing  a  proximity  network  on  the  communications  transactions  and  events, 
where  the  proximity  between  two  transactions  is  computed  as  a  function  of  their  temporal 
proximity  and  the  identities  of  the  nodes  involved  in  the  transaction.  The  Social  Network 
Analysis  technique  of  LS-Sets  is  then  applied  to  partition  the  proximity  network  into  distinct 
subsets.  Each  LS-Set  captures  a  stream  of  transactions  that  comprise  a  coordinated  set  of 
activities  toward  a  common  mission.  The  set  of  nodes  attached  to  these  transactions  thus  define 
the  membership  of  a  specific  mission  team  within  the  RED  organization.  Each  of  these 
subgroups  is  then  fed  into  the  subsequent  stages  of  the  algorithm  to  identify  the  mission  under 
execution  as  well  as  the  structure  of  roles  and  responsibilities  within  group. 

3.3  Organizational  Simulator 

Organizational  simulation  phase  models  enemy  behavior  given  enemy  organization  and 
objectives  to  generate  multiple  activity  patterns,  which  will  be  organized  into  efficient  template 
structures  via  Hidden  Markov  Models  (HMMs)  in  the  Activity  pattern  learning  phase.  These 
templates/models  can  later  be  used  to  efficiently  compare  against  the  stream  of  activity 
observations. 

The  simulation  phase  utilizes  Aptima’s  Team  Optimal  Design  (TOD)  simulation  system 
(MacMillan  et  al.,  2002),  (Levchuk  et  al.,  2005).  The  simulator  requires  the  knowledge  of 
enemy  organization  (capabilities,  ROE,  roles  and  responsibilities  of  nodes/cells/agents),  mission 
objectives,  characteristics  of  the  mission  environment,  and  organizational  processes.  Our 
premise  is  that,  for  a  specific  mission  objective,  the  meta-tasks  that  the  enemy  will  be  performing 
are  fixed,  while  the  specific  activities  to  be  performed  to  accomplish  those  tasks  (“how”  tasks  are 
accomplished)  can  change.  Thus,  an  agent  (member,  node,  or  cell  of  organization)  will  act 
according  to  its  own  process  model. 
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TOD  model  was  developed  under  several  programs,  including  the  Navy’s  Adaptive  Architecture 
for  Command  &  Control,  the  Navy’s  Manning  Affordability  Initiative,  and  Air  Force  programs. 
TOD  software  accurately  modeled  existing  AEGIS  AAW  operations  and  was  used  to  develop 
concepts  for  reducing  manning.  TOD  was  applied  to  DD-21,  design  of  teams  for  AWACS 
(U.S.A.F.),  Future  Combat  Systems  (U.S.  Army),  Joint  Forces  and  Joint  Experimentation 
programs,  and  used  to  define  the  optimal  team  structure  for  the  E-10  Multi-sensor  Command  and 
Control  Aircraft  (MC2A)  and  to  evaluate  alternative  architectures  for  C2  (e.g.,  ForceNET). 

The  central  thesis  of  prior  applications  of  the  TOD  model  was  that  a  set  of  interdependent, 
interrelated  tasks  that  must  be  completed  under  time  constraints  has  an  underlying  quantitative 
structure  that  can  be  exploited  to  design  the  “best”  team  structure  and  strategy  for  accomplishing 
those  tasks.  This  approach  is  based  on  a  multi-phase  allocation  model  that  consists  of  three 
pieces  (Figure  2a):  (i)  the  tasks  that  must  be  accomplished  and  their  interrelationships  (i.e.,  the 
“mission”);  (//)  the  external  resources  needed  to  accomplish  those  tasks  (e.g.,  information,  raw 
materials,  or  equipment),  and  (in)  the  human  agents  (decision  makers)  who  will  constitute  the 
team.  TOD  takes  data  representing  a  mission,  tasks,  and  operators,  and  applies  optimization 
algorithms  to  assign  tasks  to  team  members,  schedule  team  tasks,  and  measure  team 
performance.  A  simple  set  of  parameters  enables  the  user  to  perform  analyses  of  workload, 
coordination,  and  mission  execution  tempo  in  support  of  manning  and  trade-space  analyses.  In 
the  proposed  work,  we  will  utilize  a  scheduling  phase  of  TOD  with  hierarchical  task  allocation 
architecture  (see  superior-subordinate  operator  model  in  Figure  2.b)  to  generate  activity 
sequences. 


MISSION  ANALYSIS 
Mission 


RESOURCE 

ALLOCATION 


(a)  Three-piece  structure  of  TOD  method 


(b)  TOD  Superior-subordinate  operator  model 


Figure  2:  Team  Optimal  Design  model 

One  of  the  key  components  of  the  NetSTAR  model  is  the  conversion  of  organizational 
parameters  (structure,  responsibilities,  resources,  etc.)  into  a  process  workflow  and  process- 
action  graph.  Our  approach  is  based  on  learning  the  probabilistic  transition  (workflow  process) 
graphs  and  decision  (process-action)  graphs  from  the  predicted  process-action  sequences 
generated  via  the  Team  Optimal  Design  (TOD)  model  developed  by  Aptima  to  design  optimized 
organizational  structures,  task  execution  and  team  workflow  processes  (McMillan  et  al.  2002). 

3.4  Learning  Phase 

This  phase  defines  the  evolution  of  organizational  processes  and  activities  (including 
communication,  individual  and  team  tasking,  information  dissemination,  resource  employment, 
etc.)  using  Markov  Transition  Diagram  representation,  and  its  extension  for  the  case  of  uncertain 
observations  -  Hidden  Markov  Model  (HMM).  The  model  learns  HMM  patterns  of  enemy 
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activity  using  Baum-Welch  algorithm  from  either  historic  data  or  outputs  from  an  Organizational 
Simulator.  The  methodology  employs  supervised  and  unsupervised  learning,  extending  the 
methodology  to  address  the  issues  of  missing  observations,  task  structure,  dependencies  and 
parallelism.  We  will  use  multi-layered  HMMs  for  structure  representation,  and  factorial  and 
coupled  HMMs  for  modeling  task  dependencies  and  task  parallelism. 
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Figure  3:  NetSTAR  Monitoring  and  Action  Selection  phases 

3.5  Monitoring  and  Action  Selection  Phases 

A  first  problem  that  arises  in  structure  identification  is  to  establish  the  true  process  workflow 
performed  by  the  enemy.  Unless  this  is  attained,  the  BLUE  team  cannot  conduct  its  operations, 
else  it  risks  achieving  no  effects  (or  even  undesirable  effects)  while  wasting  its  resources.  Note 
that  throughout  the  mission,  an  enemy  organization  might  evolve  its  command,  resource,  and 
roles  distribution.  Therefore,  constantly  tracking  the  enemy  structure  is  essential  to  BLUE’s 
success.  The  same  relates  to  the  goal  model  (meta-graph)  of  the  enemy  organization,  the  actual 
goals  currently  being  performed  (meta-tasks),  and  the  individual  processes.  To  resolve  this, 
NetSTAR  proposes  to  utilize  an  iterative  procedure  consisting  of  two  phases  (Figure  3):  (1) 
monitoring  phase;  and  (2)  action  selection  phase.  The  monitoring  phase  identifies  the  most 
probable  organizational  structure  and  processes  generating  the  observed  behavior  (event  data, 
tracked  agents/cells  and  activity  data),  while  action  selection  phase  suggests  counteracting 
measures  to  be  applied  to  collect  more  information  (ISR  probes)  and/or  disrupt  enemy  activities 
(interventions).  These  two  phases  correspond,  respectively,  to  the  situation  assessment  and 
shaping  phases;  they  will  be  implemented  sequentially,  with  the  monitoring  phase  preceding  the 
action  selection  phase  and  (re)initiating  the  monitoring  phase  with  the  arrival  of  new  data, 
interventions  and  deliberate  probing.  The  action  selection  phase  will  be  initiated  when: 


•  The  pattern  of  enemy  activity  is  deemed  dangerous  with  a  high  probability;  in  this  case, 
confidence  is  high  that  the  assessed  enemy  organizational  structure,  and  the  concomitant 
operational  processes  are  active;  in  this  case,  interventions  are  needed  to  disrupt  the 
enemy; 
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•  Confidence  in  the  assessed  enemy  organizational  structure  and  the  processes  is  low;  in 
this  case,  probes  are  needed  to  obtain  additional  information  to  increase  the  confidence 
in  situation  assessment. 

A.  Monitoring  Phase  via  HMM  Solution 

In  NetSTAR’s  monitoring  phase,  the  BLUE  tracks  and  determines  the  structure  and  processes 
that  are  most  likely  to  generate  the  observed  enemy  behavior.  We  model  the  enemy  activities 
(process-action  graph  substructure  of  the  objectives/meta-task  graph)  as  a  Markov  Decision 
Process  (MDP),  where  actions  correspond  to  friendly  probes  and  intervention  activities.  The 
meta-task  substructures  of  the  enemy  correspond  to  Markov  transition  graphs  (this  part  of  the 
process-action  graph  is  also  called  process  workflow  of  RED  team)  in  the  absence  of  BLUE 
actions.  Consequently,  we  apply  HMM  modeling  techniques  to  establish  the  most  probable  RED 
structure  and  processes  (correspondingly,  organization-mission  pairs)  that  caused  the 
observations.  The  forward  HMM  algorithm  is  modified  to  include  the  iterative  update  of  the 
probability  that  a  specific  agent/node  is  observed  conditioned  on  the  role  of  the  actual  active 
agent,  update  of  the  observation  (emission)  probability,  and  subsequent  forward-backward 
recalculations.  The  method  adjusts  the  role  probabilities  to  maximize  the  likelihood  of  the  HMM 
structure  and  parameters,  and  is  terminated  when  no  improvement  is  possible.  When  the 
likelihood  of  the  best  HMM  is  above  a  user-specified  threshold,  we  declare  the  corresponding 
HMM  to  be  active,  and  proceed  to  the  “action”  phase. 

B.  Action  Phase  via  POMDP  Solution 

In  the  action  selection  phase,  knowledge  about  the  RED  organization  and  workflow  process  is 
assumed  to  be  given  (certainty  equivalence  assumption).  NetSTAR  calculates  the  action  policy 
using  the  POMDP  formulation,  where  the  basic  state  model  is  the  MDP  corresponding  to  the 
organization,  mission,  and  the  meta-task  decomposition  selected  in  the  “monitoring”  phase. 
Based  on  the  current  estimate  of  the  state,  the  POMDP-based  control  policy  identifies  the  actions 
that  the  BLUE  team  must  perform  (probing,  intervention)  in  order  to  counteract  the  RED  team. 
The  policy  is  represented  in  the  form  of  a  AND/OR  decision  tree  or  graph,  where  the  OR  nodes 
are  the  states,  and  AND  (decision)  nodes  are  the  BLUE  actions.  Note  that  some  of  the  actions  of 
the  BLUE  organization  might  involve  activities  to  gather  more  information  about  the  RED  to 
establish  more  certainty  about  the  currently  active  RED  structure  and  processes.  The  policy 
obtained  using  the  solution  for  a  specific  POMDP  formulation  is  propagated  to  the  feasible 
POMDPs  that  correspond  to  other  structure/mission  pairs.  As  a  result,  we  again  obtain  the 
Markov  transition  graphs  and  can  track  the  likelihood  of  those  HMMs  compared  to  the  HMM 
corresponding  to  the  current  organization/mission  pair.  When  the  current  model  becomes 
inactive  (probability  goes  below  a  user-specified  threshold)  or  another  HMM  is  more  likely,  we 
stop  the  action  phase  and  return  to  the  “monitoring”  phase. 

4.  Example  of  Methodology  Application  to  Identify  JTF  Organization 

In  this  section,  we  illustrate  the  NetSTAR  modeling  approach  on  the  example  related  to  Adaptive 
Architectures  for  Command  and  Control  (A2C2)  Experiment  8  conducted  at  Naval  Postgraduate 
School  using  Distributed  Dynamic  Decision-making  (DDD)  simulator  (Kleinman  et  al.,  2003). 
Without  loss  of  generality,  we  apply  our  process  to  identify  the  friendly  (JTF)  organization. 
During  human-in-the-loop  experiments,  we  experimented  with  multiple  organizational 
configurations  and  different  missions,  and  collected  the  communication  data  from  commander 
interactions  (asset  request,  information  request/communication,  acknowledgement, 
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synchronization  request,  etc.)  and  events  data  (what  tasks  are  done,  when,  by  what  decision 
makers,  what  resources/assets  used,  etc.)  (see  (Diedrich  et  al.,  2003)  for  more  info  about  data 
collection).  In  this  section,  we  describe  what  organizations  and  missions  where  used  in  the 
experiment,  and  how  the  NetSTAR  process  can  be  applied  to  identify  what  organization  and 
mission  are  currently  active  given  a  streaming  set  of  observations  (events  and  transactions  data) 
from  the  collected  communication  data  and  events.  In  the  following,  we  make  multiple 
simplifications  from  the  original  Experiment  8  to  avoid  unnecessary  complexity. 

In  the  Experiment  8,  we  conducted  multiple  runs  for  two  distinct  types  of  the  organizations  - 
Divisional  (with  assets  uniformly  distributed  among  commanders)  and  Functional  (with  assets 
distributed  to  create  unique  functional  commanders).  The  runs  utilized  two  distinct  mission 
types  -  “d”  and  “f’,  where  the  former  was  “matched  to”  (congruent  with)  Divisional 
organization  and  “mismatched  with”  (incongruent  to)  Functional  organization.  Reverse  was  true 
for  “f’  mission  scenario  (see  (Kleinman  et  al.,  2003)  for  more  details).  The  difference  between 
“d”  and  “f  ’  is  only  in  the  resources  that  are  required  to  execute  the  tasks.  This  means  that  while 
the  goals  (meta-tasks)  are  geographically  the  same  for  each  mission,  their  meaning  is  different 
(methods  to  achieve  these  goals  are  different).  In  our  human-in-the-loop  simulations,  we  used 
multiple  human  teams  to  effects  of  individual  biases.  Since  rarely  any  two  human  organizations 
perform  alike,  we  might  need  to  consider  adding  each  such  instance  to  the  KB.  However, 
considering  abstract  organizations  would  be  enough  to  illustrate  the  proposed  concepts. 


Geographic  Layout  Meta-Task  Graph 


Figure  4:  Mission  geographic  layout  and  meta-task  graph  (same  for  “d”  and  “f”) 

Mission  consists  of  7  meta-tasks:  CMD  (eliminate  Command  Center),  BRG  (blow  bridge),  NBE  (take  Naval  Base- 
East),  NBW  (eliminate  Naval  Base-West),  ABE  (take  Air  Base-East),  ABW  (eliminate  Air  Base-East),  and  MINE 

(clear  Mines  in  port) 

Step  1:  Creating  Knowledge  Base.  We  start  by  hypothesizing  that  the  knowledge  base  consists 
of  two  missions  -  “d”  and  “f  ’  (parameters  of  simplified  missions  are  depicted  in  Figures  4-5) 
and  two  organizations  -  “Divisional”  and  “Functional”  (simplified  organizations  are  depicted  in 
Figure  6). 
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0 
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0 
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1 
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1 

0 

3 

1 
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0 

0 

0 

3 
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0 

0 

2 

1 
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Clear  Mines 

1 

1 

0 

0 

Figure  5:  Task  resource  requirements  for  “d”  and  “f”  missions 


Resources  (JTF  platforms) 


Name 

Description 

Mines 

ASuW 

Strike 

SOF 

F18S 

MH53 

FAB 

SOF 

FLAM 

Strike  aircraft 
Mine  clearing  helo 

Fast  attack  boat 
Special  Ops  unit 
Tomahawk  missile 

0  0  2  0 

10  0  0 

0  10  0 

0  0  0  1 

0  0  10 

Dl  VI  SI  ONAL  Organization 


•  SOF 


FUNCTI  ONAL  Organization 


Figure  6:  Divisional  and  Functional  organizations 

There  are  5  assets  in  the  organization.  4  functional  capability  areas  are  modeled:  Mines  (mine  clearing),  ASuW 
(anti-surface  warfare),  Strike  (ground  strike),  and  SOF  (special  operations  forces) 

Step  2:  Simulating  Organizational  Behavior.  In  this  phase,  we  run  our  TOD  simulation  process 
to  generate  activity/communication  transactions  and  events  data  for  each  organization  and 
mission  pair  from  the  Knowledge  Base.  In  this  example,  our  approach  is  based  on  decomposing 
meta-tasks  into  actions  based  on  decision-action-assessment  process  loop  depicted  in  Figure  7. 
Accordingly,  the  simulator  generates  multiple  action  and  communication  transaction  sequences 
(e.g.,  see  Figure  8)  for  each  organization-mission  pair.  The  diversity  is  due  to  alternatives  in 
executing  actions  due  to  overlap  in  resource  capabilities,  responsibilities  of  organizational  nodes, 
and  uncertainty  in  preferences  of  the  team  members,  and  is  captured  by  the  TOD  simulator. 


Identify  Task 
&  Actors 


Communication 
with  other  actors 


Communication  to 
request  resources 


Figure  7:  Decision- Action- Assessment  process  loop 
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Action  Selection  Alternatives:  Activity  Generation  Reasoning 


Resources  are 
available  and 
committed 


F18S  is  moved 
into  vicinity 


Attack  sequence  is 
initiated  from  CVN 
to  DDGB 


TLAMs  launched 
from  DDGB 


Synchronized 

attack 


Resources  are  not 
available;  actor  attempts 
to  prosecute  task  with 
inadequate  resources 


Resources  are 
available;  but 
proper  planning 
not  performed 
(unsynchronized 
launch  occurred) 


Figure  8:  Example  of  action-communication  and  event  transactions  sequences  generated  by  TOD  for 
meta-task  NBW  (eliminate  Naval  Base-West)  of  scenario  “f  ’ 


Step  3:  Learning  Behavior  Patterns.  In  this 
process  to  learn  the  Markov  transition 
graphs  or  HMM  patterns  of  activities  from 
the  transaction  sequences  generated  in  the 
previous  step.  This  phase  is  essential  in 
creating  the  compact  representation  of 
activity  patterns  to  identify  the  active 
organization-mission  pair  via  matching 
these  activity  patterns  against  real-time 
observations  in  the  monitoring  phase. 
Figure  9  shows  the  example  of  learned 
Markov  Chain  pattern  of  Divisional 
organization  activity  for  a  single  meta-task 
of  scenario  “f ’.  The  full  pattern  for  the 
whole  mission  (full  meta-task  graph)  will 
be  generated  by  merging  individual  meta¬ 
task  activity  patterns. 

Step  4:  Group  Identification.  This  step 
identifies  the  subgroups  within  the  total  set 
of  RED  nodes  under  surveillance  that  are 
actively  collaborating  toward  a  mission. 
The  essence  of  this  step  is  to  match  the 


step,  we  utilize  the  learning  phase  of  NetSTAR 


Figure  9:  Example  of  learned  Markov  Chain 
pattern  of  Divisional  organization  activity  for  a 
single  meta-task  of  scenario  “f  ’ 
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observations  to  a  single  organization.  In  the  example  presented  in  this  section,  we  assume  that 
the  observations  correspond  to  a  single  organization,  and  the  identities  of  the  agents  and/or  cells 
are  known  (while  their  true  roles/places  in  the  organization  are  not). 

Step  5:  Identifying  Active  Organization-Mission.  In  this  step,  we  utilize  the  monitoring  phase  of 
NetSTAR  process  to  match  the  observation  stream  with  learned  activity  patterns.  As  the  result, 
we  can  calculate  the  likelihood  that  organization  is  acting  on  specific  mission  for  each  pair  from 
the  knowledge  base.  First,  we  identify  the  probability  of  observations  conditioned  on  true 
actions.  Feasible  observation  classes  are  listed  in  Table  I.  A  sequence  of  received  observations 
and  the  matching  (true)  activities  of  Divisional  organization  that  could  have  generated  these 
observations  are  shown  in  Figure  10. 


TABLE  I:  Example  of  observation  classes 


Class 

Parameters 

Remarks 

Communication  between 
actors 

Initiators,  Content  (asset  request;  activity 
initiation;  report;  asset  transfer),  Duration 

Roles/identities  are  not 
known 

Launch  and/or  movement  of 
platforms 

Duration 

Engagement 

Initiation;  Resource  discrepancies;  Duration 

Task  execution  success 

Success  rate 

NULL 

No  observations 

Time  Observations  Matching  Processes/ Activities  for  DIVISIONAL  Organization 


00:05 

00:10 

00:25 

00:30 

00:55 

01:05 

01:15 

01:30 

01:32 

01:44 


Figure  10:  Sequence  of  observations  received  by  NetSTAR  system,  and  the  matching  (tme)  activities  of 

Divisional  organization 

We  apply  the  forward  HMM  algorithm  to  calculate  the  likelihood  of  observed  sequence  given 
the  model  (an  activity  pattern  for  organization-mission  pair).  Figure  11  shows  the  dynamic 
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graph  of  the  conditional  observation  probabilities  for  4  organization-mission  activity  models. 
The  likelihood  of  the  observation  sequence  is  a  quantitative  measure  of  the  confidence  of  the 
match  between  the  observed  events  and  transactions  and  the  template  models.  The  HMM 
determines  whether  the  monitored  activity  exists.  If  the  activity  is  consistent  with  the  model 
derived  in  the  step  3,  then  it  is  called  detected.  Note  that  a  conflict  of  the  activity  patterns  can 
result  in  multiple  activities  being  active  at  the  same  time.  This  could  also  be  modeled  using 
multiple  hypothesis  tracking  (Singh  et  al.,  2004). 


Organization 

Mission 

Likelihood 

DIVISIONAL 

f 

0.65 

DIVISIONAL 

d 

0.18 

FUNCTIONAL 

f 

0.22 

FUNCTIONAL 

d 

0.12 

Figure  11:  Example  pattern  matching  in  monitoring  phase 
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Figure  12:  Example  of  outcome  of  monitoring  phase:  Divisional  organization  and  its  mission 

(in  mission  progress  graph,  blue  color  indicates  the  percentage  of  completion  of  a  meta-task) 

The  organization-mission  pair  is  selected  to  maximize  the  observation  likelihood,  for  which  the 
resource  assignment,  agent  roles,  task  assignment,  and  mission  progress  is  obtained  (Figure  12). 
Task  assignment  and  mission  progress  can  be  obtained  by  identifying  the  highest-probable 
activity  sequence  that  generated  the  observation  sequence. 

5.  Conclusions  and  Future  Validation  Mechanisms 

This  paper  presents  a  novel  methodology  that  utilizes  the  historic  operational  knowledge  and 
dynamically  observed  events  and  communications  data  to  identify  the  processes  and  structure  of 
the  opposing  organization,  its  objectives,  mode  of  operation,  and  execution  policy.  Proposed 
approach  requires  empirical  validation  of  the  NetSTAR  model,  which  we  propose  to  proceed  in 
three  successive  rigorous  stages:  laboratory,  historical,  and  operational.  The  laboratory 
validation  will  leverage  experimental  data  obtained  through  the  Advanced  Architectures  for 
Command  and  Control  (A2C2)  program  sponsored  by  the  Office  of  Naval  Research  (McMillan 
et  al.  2002).  This  research  generated  a  set  of  human-in-the-loop  experiments  (see  for  example 
(Diedrich  et  al.,  2003),  (Entin  et  al.,  2003),  (Kleinman  et  al.,  2003))  in  which  cadets  at  the  Naval 
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Postgraduate  School  participated  in  a  joint  military  operations  using  the  Distributed  Dynamic 
Decision-making  simulation  platform  (Kleinman  et  al. ,  1996).  During  each  experimental  trial, 
complete  data  were  recorded  as  to  the  roles  and  resources  of  the  team  members,  communications 
between  decision  makers,  and  the  actions  carried  out  by  the  team.  From  this  data  we  can  extract 
the  chatter  levels  and  isolated  events  within  the  team,  which  will  then  be  input  into  the  NetSTAR 
algorithm  to  test  its  ability  to  reconstruct  the  true  mission  and  structure  of  the  team.  The 
historical  validation  will  focus  on  testing  the  ability  of  NetSTAR  to  accurately  identify  the 
structure  and  activities  of  a  known  RED  organization  whose  true  (current)  structure  and  activities 
are  now  known.  Finally,  the  operational  validation  will  evaluate  NetSTAR  against  a  current 
RED  organization  whose  structure  and  activities  are  unknown.  This  form  of  validation  will 
entail  a  longitudinal  study  in  which  the  accuracy  of  NetSTAR  is  continuously  re-evaluated  as 
new  information  becomes  available. 
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Overview 
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■  The  problem:  notional  scenario 
p  The  need:  design  problem 

i  NetSTAR  system  process 

■  HMM-based  activity  modeling 

■  Previous  work 

■  Next  steps 

■  Example 


dma 

Human  -  CenTrr 


Human  -  Centered  Engineering 


Mission:  US  SOF  assist  the  army  of 
Urbanistan  (AOU)  in  their  spring  offensive 
against  the  territories  held  by  the  militant 
rebel  coalition  called  True  Sons  of 
Urbanistan  (TSU). 

Situation:  TSU  irregulars  are  well 
concealed  in  towns  and  mountains  of 
their  Liberated  Zone.  Extensive  system  of 
tunnels  and  caves.  Porous  borders  with 
neighboring  countries. 

Friendly  intel  capabilities:  US  multi-INT 
capabilities  plus  Urbani  Intelligence 
Service’s  extensive  HUMINT. 

Enemy  Command  and  Control:  TSU  is 

led  by  a  network  of  several  disparate 
organizations,  ranging  from  informal  cells 
to  military  structure. 

Plan  of  the  offensive:  AOU  forces 
penetrate  the  Liberated  Zone  along  4 
avenues  of  approach.  NLT  H+72  seal  the 
borders.  Defeat  larger  units  of  TSU  with 
the  help  of  US  air  assets  and  AOU  armor. 
NLT  H+240  force  TSU  fighters  into 
several  base  towns.  Isolate  and  conduct 
clean-up  operations. 


Notional  Scenario 


■  Current  info  on  Enemy  C2: 

#136: . 

#1 37:  Abbadirov  -  commander  of  the  Lions  Brigade. 
Former  Soviet  Spetsnaz  officer.  Style  of  command 
decision-making:  influenced  by  traditional  Soviet. 

#138:  Lions  Brigade  Staff:  10-12  people,  some  with  FSU 
military  training. 

#139:  Commander,  Mountain  Martyrs  Detachment  (name 
unknown).  Uses  cell  system.  Supported  by  an 
influential  deputy  and  2-3  senior  advisers. 

#140:  Bobbimov:  manages  a  logistics  cell  of  5-10  “brain” 
people  in  Gosh  across  the  Ruralstan  border. 
Supplies  the  Lion  Brigade  and  sometimes  the 
Mountain  Martyrs. 

#141:  Qashcow  Tribal  Council:  10-15  people,  control  up 
to  200  local  fighters.  Report  to  Abbadirov  but  often 
stays  neutral. 

#142:  Gollyadov:  Field  Commander  of  semi-independent 
formation.  Staff  of  4-7  competent  personnel. 
Coordinates  with  Mountain  Martyrs. 


#143: 


Notional  Scenario: 
Threats  and  Opportunities 
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Threats  to  the  AOU  Offensive  Plan: 

Massive  exfiltration  of  TSU  into  the 
Dizzikh  region 

Rapid  concentration  in  well- 
defended  town  of  Eddiren 

Cross-border  instigation  of 
uprising  in  Ruralstan’s  town  of 
Gosh 


Feasible  AOU  Actions  to  Impact 
TSU  C2: 

■  Feint  advance  toward  the 
Qashcow  tribal  center. 

■  Precision  elimination  of 
Abdykadirov’s  Deputy 

Temporary  disruption  of  comms 
between  Gollyadov  and  Qashcow 

Disinformation  about  defection  of 
Bobbimov  to  Government 

....  And  about  50  other  possibilities 


Questions: 

1.  What  combination  and  timing  of  actions  would  yield  best  observables  to 
improve  our  knowledge  of  the  TSU  C2  structure? 

2.  What  combination  and  timing  of  actions  will  best  reduce  the  effectiveness 
of  TSU  C2  and  minimize  the  threats  to  AOU  plans? 
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■  Need  to  disrupt  activities  of  the  enemy 

■  Consider  enemy  military  with  significant  Command  and 
Control  (C2)  organization 

TO  act  against  enemy  effectively,  need  to  know: 

■  What  the  enemy  IS? 

•  — »  Enemy  C2  structure,  roles,  actors,  resources 

■  What  the  enemy  WANTS  TO  DO? 

•  >  Enemy  goals/objectives 
»  What  the  enemy  DOES? 

•  Enemy  actions 

■  Need:  System  Identification-like  Models 

■  Focus  on  what  organization  is  rather  than  how  it  can  be 
changed 


How  it  is  done  today? 
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■  What  is  available: 

■  Manual  procedures  for  analyzing  enemy  C2  decision-makers, 
processes,  impacts 

»  Commercial  tools  for  data  collection  and  visualization 

■  Static  networks  topology  metrics  tools 

■  Targeting  heuristics  (centrality,  in-between-ness,  etc.) 
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Question: 

Given  what  we  can 
obsewe  about  an  enemy, 
can  we  determine  its 
underlying  structure  and 

activities? 


Answer 


NetStar  system  for  identification  of  Network  Structure,  Activity  and  Roles 
Leverages  models,  algorithms,  and  test  data  from  A2C2  program 
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Proposed  NetSTAR  Research: 

Reverse  Engineering 

Observed  Events 


Uncertainty  of  Observations 


Chatter 


Levels 


Message  Decoding 


Agent 

Start 

End 

Action 

Khalid 

1401.10 

1410.43 

Explosives  Acquisition 

Activity  I  nvolvement 

Khalid 


Nawaf 


Salem 


Hani  Saeed 

C2  Organization 

Khalid 


Majed ' 
^  Nawaf 


Hani 


W 

m 


Saeed 


Salem 


Sender 

Receiver 

Start 

End 

Khalid 

Majed 

1400.03 

1400.07 

< 

Majed 

Khalid 

1400.10 

1400.12 

< 

(...“explosives”. 


NetSTAR 


1 1*  ■  ■ 

e=i=g=l 

J_  _Q 

l_“  c 

— 


Reconstruct  the  mission, 
organization  and  roles 
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Knowledge  Base 


Historic  Data 
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Estimate  HMMs  of  behaviors  for  each 
organization-mission  combination 


Learning  components  (can  be  off-line) 
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Can  Activities  be  Modeled? 
Are  there  Distinguishable  Patterns? 


Yes!!! 
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Why?: 


■ 

■ 
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Patterns/templates  of  “how  to  achieve  a 
purpose” 

Sub-activities  depend  on  one  another 

•  Precedence 

•  Parallelism 

•  Geo-dependence 

•  Timed  dependence 

•  Input-output  (influence) 

People  follow  patterns  in  their  daily 
routines 

C2  organization  MUST  FOLLOW 
PATTERNS  due  to  its  design  - 
constraints  on 


Who  can  do  what 

Who  communicates  to  whom 

Who  owns  what 

Who  supports  whom 

Who  has  authority  over  whom 
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Human  -  Centured  Engineering 


Activity  Structure  Modeling 

Global  Intention  &  Behavior  Matching 


Goals  satisfaction 


Matching  observations 
and  activities 
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Goals  Level: 
Meta-task  Graphs 


Activity  Level: 
HMMs 


Input  Level: 

Preprocessed  Observations 


Aptima 

Hum  ant  -  f.  r  n  T  it 


Human  -  Centered  Engineering 


Why  Hidden  Markov  Models? 


Model  relationships  between 

■  Hidden  events 

■  Hidden  true  patterns  of  events 

(event  structure) 

■  Observations  which  are  uncertain 
representations  of  true  events 
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»  Question: 

■  Can  I  know  what  is  true  from  what  I 
see? 

Rephrase: 

■  What  model  explains  my  observations 
better? 

■  What  actually  happended  in  that 
model? 


HMMs  can 

■  Identify  most  likely  event  pattern  that 
produced  observations 

■  Identify  the  most  likely  set  of  true 
(hidden)  events  that  occurred 

■  Learn  the  pattern  structure  and 
parameters  given  multiple  realizations 
(event/obseravtion  sequences) 

Specific  Uses 

■  Voice/speech  recognition 

■  Image  (e.g.  handwriting,  faces,  etc.) 
recognition 

■  Signal  detection 

■  Activity  detection,  environment 
evolution 

■  Control  systems 

■  Segmentation  of  DNA  sequences  and 
gene  recognition 

■  Stock  data  analysis 
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Issues  in  Activity  Modeling  (continued) 


HMMs  can  model 

■  Time  dependence 
(duration) 

■  Absence  of  observations 


(a)  Temporal  constraints  (b)  Sequential  implementation 


Strike  Ops 
in  Kabul 


■  Multiple  observations 

»  Observation  from  possibly 
multiple  sources 

■  Influence  between  events 

•  Alternative  events 

■  Parallel,  sequential  events 

■  Constraints  in  time, 
geography,  etc.  resulting  in 
changed  sequencing  of 
events 


or 


(c)  Spatial  constraints 


(d)  Influence  &  alternatives  (e)  Parallel 


Infantry  Ops 
in  Kabul 
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Modeling  Methodology: 
Coupled,  Hierarchical  &  Layered  HMMs 
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Previous  Work  (Aptima/UConn) 


A2C2  Experiments 

■  Reverse-engineered  missions  and 
organizations  to  test  congruence 
concepts 

■  Conducted  multiple  human-in-the-loop 
experiments 

»  Simulated  models  predicted  the 
patterns  of  human  performance 
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with  DDD 

■  Obtained  comparable  results  for 
human-in-the-loop  and  agent  runs 


NEMESIS-ASAM  (Adaptive  Safety 
Analysis  and  Monitoring) 

■  Predict  possible  existence  &  evolution 
of  the  terrorist  activities  from  noisy 
transactions  data 

■  Identify  threats  (via  ASAM  detection 
schema)  &  suspicious  persons  (via 
feature-aided  tracking) 
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Next  Steps: 
NetSTAR  Monitoring-Action  Integration 
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Two  Organizations  Command  Network  and  Resource  Control  Structure 

Resources  (J  TF  platforms)  Dl  VI  SI  ONAL  Organization  FUNCTI ONAL  Organization 
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Task-Activity  Generated  for  “NBW”  task 
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Example:  Observations 


Time  Observations  Matching  Processes/ Activities  for  Dl  VI  SI  ONAL  Organization 


Agent  1  communicates 
to  Agent  2 


Agent  1  communicates 
to  Agent  2,  3 


Asset  F18S-1  is 
launched 


Asset  F18S-2  is 
launched 


Assets  F18S-1  &  F18S-2 
are  converging 


Attack  message 
intercepted  to  2,3 


3  TLAM  launches 
observed 


3  TLAMs  close  on  area 
NW 


Agent  2  communicates 
to  agent  1 


CVN  communicates  activity 
initiation  to  DDGB  &  CG 


CVN  communicates  activity 
initiation  to  DDGB  &  CG 


CVN  requests  commitment 
from  CG,  DDGA 

CVN  requests  commitment 
from  CG,  DDGA 

CVN  requests  commitment 
from  DDGB 


F18S  is  moved 
into  vicinity 


2  F18S's  are  moved 
into  vicinity 


F18S  is  moved 
into  vicinity 


2  F18S's  are  moved 
into  vicinity 


2  F18S's  are  moved 
into  vicinity 


Attack  sequence  is  initiated 
from  CVN  to  CG  &  DDGA 


TLAMs  launched 
from  DDGB 


TLAMs  launched 
from  DDGA 


Synchronized  attack 


Unsynchronized  attack 


Observations: 

Communication  between  actors 

■  Initiators 

■  Content  (asset  request;  activity 
initiation;  report;  asset  transfer) 

■  Duration 

■  Roles/identities  are  not  known 
Launch  and/or  movement  of  platforms 

■  Duration 

■  Engagement 

■  Initiation 

■  Resource  discrepancies 

■  Duration 

■  Task  execution  success 

■  Null  (no  observations) 


Synchronized  attack 


Unsynchronized  attack 


NW  area  heavy 

Target  destroyed  100% 

Target  destroyed  50% 

explosions  observed 

01:44 
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Example:  Results 


Active  Monitoring 


Organization 

Mission 

Likelihood 

DIVISIONAL 
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DIVISIONAL 
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FUNCTIONAL 
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FUNCTIONAL 
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0.12 

Agent  Network 


Agent  Assignments 


Monitored  Agents 

Roles 

Primary 

Tasks 

Supported 

Tasks 

Tasks  in 
Progress 

Agent- 1 

CVN 

NBW,  BRG 

Agent-2 

CG 

ABE 

MINES,  NBW 

Agent-3 

ABE 

CMD 

MINES 

Agent-4 

DDGB 

CMD 

ABE 

NBW 

Monitored  Agents 

Roles 

Asset 

t/Resource  Control 

Agent- 1 

CVN 

F18S 

FAB 

MH53 

SOF 

Agent-2 

CG 

F18S 

FAB 

MH53 

SOF 

Agent-3 

10TLAM 

FAB 

MH53 

SOF 

Agent-4 

DDGB 

10TLAM 

FAB 

MH53 

SOF 

Mission  Progress 


Conclusions 
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■  Proposed  methodology  to  identify  the  organization 
structure  and  mission 

■  Based  on  activity  matching 

■  Activities  are  modeled  using  Hidden  Markov  Models 

■  Future  steps:  integration  with  action  component 
using  Partially  Observable  Markov  Decision  Problem 
representation 
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THANK  YOU! 
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Backups 


Aptima,  Inc 


dma 

Human  -  CenTrr 


Human  -  Centered  engineering 


i  Inter-disciplinary  Small  R&D  Business 

■  80+  staff  members  (>80%  advanced  degrees) 

»  Among  the  leading  Human  Engineering  firms  in  the  US 

■  Supported  by  100+  corporate  and  academic  partners 

■  Wide  range  of  repeat  clients  in  government  and  industry 

Focus:  Human  Centered  Engineering 


Areas  of  Expertise 

Human  Factors 
Organizational  Psychology 
Cognitive  Science 
C2  Operations 
Mathematical  Modeling 
Software  Engineering 


Domains  of  Application 

Military  Command  and  Control 
I  ntelligence  Analysis 
Aerospace  Systems 
Medical  Systems 

Business  &  Consumer  Software  Products 


Mission 

Requirements 


System 

Technology 


Organizational 

Structure 


Products  and  Services 

Organizational  Design  Tools 
Social  &  Organizational  Behavior  Models 
HSI  Design  and  Evaluation 
Cognitive  Analysis 
Training  Systems 
Performance  Assessment 
Competency  Analysis 
I  ntelligent  Agents 
Synthetic  Task  Environments 
Controlled  and  Field  Experiments 
Decision  Support  Systems 


Human  Agent 
Capabilities 


Next  Steps 
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■  From  Identification  to  Action 

■  =^>  from  HMM  to  POMDP 

■  Action  policies  in  POMDP  create  different  HMMs 


HMM  Pattern/ Model: 

Work  o.  6 
in  office 


POMDP:  effect  of  actions/decisions 


I  n  a 

Meeting 


Regular 
day  & 
SPEYES 
meeting 


Work 
in  office 


nal  report 
due 


P= 


T rue  activity  sequence: 

office  ►j- 


office 


-H4 


kitchen 


meeting 


office 


Observations: 

Talked  to  Mike  Responded  to  Seen  in  kitchen  Division  meeting  Met  in  the  office  Overheard  yawning 
over  phone  E-mail  grabbing  lunch  with  Adam  in  the  office  © 
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time 


time 
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Transition  from  POMDP  to  HMM 
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Did  not 
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If  specific  action  policy  is  predicted/specified, 
POMDP  is  transformed  to  HMM 

■  Different  (possibly)  for  each  action  policy 

■  Differ  in  pattern/structure 

■  Differ  in  transition/observation  probabilities 


Work  0. 6 
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HMM-2 

Work  0. 9 
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Hypotheses 
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2:  Net  Clustering 


Classification 
and  subgroup 
identification 


Output 


VDT  Organizational 
Simulator 


Simulated  Events  & 
Activity  Sequences 


1:  Activity  Learning 


HMM-based  Activity 
Pattern  Learning 

.  1 * 


Activity  HMM  Patterns 


HMM-based  Activity 
Matching  with 
Probabilistic  Roles 
Association 


Likelihood  Calculations 
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Objectives 
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Command  Structure,  Roles, 
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Objectives  Completion  and 
Activity  Involvement 


